Mozilla spars with Microsoft over WebGL security

Last week, Microsoft raised some hackles in the Web development community by claiming that there was no way to implement the WebGL open 3D graphics standard in Internet Explorer without exposing users to unacceptable potential security risks.

WebGL is a 3D graphics environment build on OpenGL 2.0, used for many 3D games and technologies, and promises to bring hardware-accellerated 3G graphics support to Web browsers. Google Chrome and Mozilla Firefox already support WebGL, and Opera and Safari are working on support. However, while Microsoft has made many strides with Internet Explorer 9—and is already showing off work on IE10— Internet Explorer offers no support for WebGL.

In a detailed posting, Microsoft outlined its primary reasons for considering WebGL a security risk: that WebGL exposes hardware functionality (e.g. video cards and processing) to Web content in an “overly permissive” way, that WebGL security servicing relies too heavily on third party components, and that today’s graphics systems were never intended to cope with shaders and 3D geometries that are specifically designed as attacks.

“We believe that WebGL will likely become an ongoing source of hard-to-fix vulnerabilities,” Microsoft wrote. “In its current form, WebGL is not a technology Microsoft can endorse from a security perspective.”

Not surprisingly, WebGL supporters take issue with Microsoft’s position, and leading the charge for the moment is Mozilla’s VP of technical strategy, Mike Shaver, who notes that Microsoft seems to overcome all of the concerns it has over WebGL in its own Silverlight technology. Although Silverlight uses Microsoft’s own Direct3D technology on Windows, on Mac OS X Silverlight taps into OpenGL in pretty much the same manner as WebGL.

“I suspect that whatever hardening [Microsoft] applied to the low-level D3D API wrapped by Silverlight 3D can be applied to a Microsoft WebGL implementation as well,” Shaver wrote. “That Silverlight supports Mac as well, where these capabilities must be mapped to OpenGL, makes me even more confident.”

Shaver acknowledges security issues in WebGL are real—including bugs that impact Firefox’s WebGL implementation. However, Shaver argues these issues are like security issues in any other technology and are being addressed by a responsible ecosystem of partners and developers.

“It may be that we’re more comfortable living on top of a stack we don’t control all the way to the metal than are OS vendors,” Shaver wrote, “but our conversations with the developers of the drivers in question make us confident that they’re as committed as us and Microsoft to a robust and secure experience for our shared users.”

A biohacker, pharmahacker, and two bioethicists walk into a bar. We ordered them a metaphorical round and had a chat about the risks and rewards of DIY medicine — from unsanctioned gene therapy to medication made on the kitchen counter.

We've compiled a list of the best Chromebooks -- laptops that combine great battery life, comfortable keyboards, and the performance it takes to run Google's lightweight Chrome OS. From Samsung to Acer, these are the Chromebooks that really…

If you're feeling frustrated with Microsoft Edge, or have run into a serious problem with Windows 10's built-in browser, take a look at these common issues and the solutions that can help you get back on track.

Choosing which apps to download is tricky, especially given how enormous and cluttered the Google Play Store has become. We rounded up 100 of the best Android apps and divided them neatly, each suited for a different occasion.

To reach its rumored launch timeline of later this year for its low-cost notebook, Apple is expected to begin production of its updated MacBook Air soon. The sub-$1,000 laptop could launch as early as September or October.

A team of Chinese researchers revealed this week that they were able to use a cracked Amazon Echo to exploit a series of Alexa interface flaws to take control over an unteuched Echo running on the same network.

Researchers have successfully hacked John McAfee's Bitfi cryptocurrency wallet. Researchers show that the device can be hacked, as they have gained access to the device's private keys and passphrase despite McAfee's security promotion.

Which music streaming platform is best for you? We pit Spotify versus Pandora, two mighty streaming services with on-demand music and massive catalogs, comparing every facet of the two services to help you decide which is best.

The best laptop should be one that checks all the boxes: Great battery life, beautiful design, and top-notch performance. The laptops we've chosen for our best laptops you can buy do all that — and throw in some extra features while…

A recent survey questioned 595 VR and AR professionals about business growth in the consumer and enterprise markets. Only 24 percent report strong sales in the enterprise while 18 percent show strong sales in the consumer market.

Gamers will have something exciting to look forward to next week when Gamescom starts. Nvidia posted a teaser video to YouTube containing hints that it could use the venue to announce the new GeForce RTX 2080 graphics chip.

Nvidia revealed its new graphics chip design called “Turing” during SIGGRAPH 2018. Rumored to be the foundation of Nvidia’s next family of GeForce cards, the company instead showcased Turing in Quadro RTX-branded cards for pros.